fix(opencode): resolve 403 FreeTierError with canonical session format and valid User-Agent
OpenCode upstream validates free-tier requests: User-Agent must be opencode/<version> (>= 1.17.0) and x-opencode-session must match canonical ses_ format. Default OPENCODE_UA to opencode/1.18.31, generate canonical descending session IDs, provide deterministic foreign session translation, and isolate credentials per-request.
This commit is contained in:
anojndr
@@ -7,19 +7,100 @@ import { resolveSessionId } from "../utils/sessionManager.js";
|
||||
import { isMuseSparkModel } from "../providers/models/helpers.js";
|
||||
import { ANTHROPIC_API_VERSION } from "../providers/shared.js";
|
||||
|
||||
const OPENCODE_UA = "opencode";
|
||||
const OPENCODE_UA = "opencode/1.18.31";
|
||||
const MAX_SESSION_LENGTH = 256;
|
||||
const SESSION_HEADER = "x-opencode-session";
|
||||
const SESSION_FIELD = "_opencodeSession";
|
||||
export const OPENCODE_SESSION_RE = /^ses_[0-9a-f]{12}[0-9A-Za-z]{14}$/;
|
||||
const BASE62_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
||||
|
||||
function hasValidOpencodeVersion(ua) {
|
||||
const m = String(ua || "").match(/opencode\/(\d+)\.(\d+)(?:\.(\d+))?/i);
|
||||
if (!m) return false;
|
||||
const major = parseInt(m[1], 10);
|
||||
const minor = parseInt(m[2], 10);
|
||||
return major > 1 || (major === 1 && minor >= 17);
|
||||
}
|
||||
|
||||
// Models served by /zen/v1/responses; every other model stays on /chat/completions.
|
||||
const RESPONSES_MODELS = new Set([
|
||||
"muse-spark-1.2-contributor-free",
|
||||
"muse-spark-1.3-contributor-free",
|
||||
]);
|
||||
const MESSAGES_MODELS = new Set(["union-alpha"]);
|
||||
|
||||
function generateRequestId() {
|
||||
return `msg_${crypto.randomUUID().replace(/-/g, "")}`;
|
||||
let lastTimestamp = 0;
|
||||
let counter = 0;
|
||||
|
||||
function unstableRandom() {
|
||||
const bytes = crypto.randomBytes(14);
|
||||
let randomPart = "";
|
||||
for (let i = 0; i < 14; i++) {
|
||||
randomPart += BASE62_CHARS[bytes[i] % 62];
|
||||
}
|
||||
return randomPart;
|
||||
}
|
||||
|
||||
function generateSessionId() {
|
||||
return `ses_${crypto.randomUUID().replace(/-/g, "")}`;
|
||||
export function generateSessionId(timestamp = Date.now()) {
|
||||
if (timestamp !== lastTimestamp) {
|
||||
lastTimestamp = timestamp;
|
||||
counter = 0;
|
||||
}
|
||||
counter++;
|
||||
|
||||
const current = BigInt(timestamp) * 0x1000n + BigInt(counter);
|
||||
const value = ~current;
|
||||
const time = Array.from({ length: 6 }, (_, index) =>
|
||||
Number((value >> BigInt(40 - 8 * index)) & 0xffn)
|
||||
.toString(16)
|
||||
.padStart(2, "0")
|
||||
).join("");
|
||||
return `ses_${time}${unstableRandom()}`;
|
||||
}
|
||||
|
||||
export function generateRequestId(timestamp = Date.now()) {
|
||||
const current = BigInt(timestamp) * 0x1000n + 1n;
|
||||
const value = current;
|
||||
const time = Array.from({ length: 6 }, (_, index) =>
|
||||
Number((value >> BigInt(40 - 8 * index)) & 0xffn)
|
||||
.toString(16)
|
||||
.padStart(2, "0")
|
||||
).join("");
|
||||
return `msg_${time}${unstableRandom()}`;
|
||||
}
|
||||
|
||||
export function translateSessionId(sessionId, clientTool = "") {
|
||||
if (typeof sessionId === "string" && OPENCODE_SESSION_RE.test(sessionId.trim())) {
|
||||
return sessionId.trim();
|
||||
}
|
||||
const digest = crypto
|
||||
.createHash("sha256")
|
||||
.update(`opencode\0${clientTool || "generic"}\0${sessionId || ""}`)
|
||||
.digest();
|
||||
const timeHex = digest.subarray(0, 6).toString("hex");
|
||||
let randomPart = "";
|
||||
for (let i = 6; i < 20; i++) {
|
||||
randomPart += BASE62_CHARS[digest[i] % 62];
|
||||
}
|
||||
return `ses_${timeHex}${randomPart}`;
|
||||
}
|
||||
|
||||
function normalizeSession(value) {
|
||||
if (typeof value !== "string") return null;
|
||||
const normalized = value.trim();
|
||||
if (!normalized || normalized.length > MAX_SESSION_LENGTH) return null;
|
||||
return normalized;
|
||||
}
|
||||
|
||||
function nativeSession(headers) {
|
||||
if (!headers || typeof headers !== "object") return null;
|
||||
for (const [key, value] of Object.entries(headers)) {
|
||||
if (key.toLowerCase() === SESSION_HEADER) {
|
||||
const normalized = normalizeSession(value);
|
||||
if (normalized && OPENCODE_SESSION_RE.test(normalized)) return normalized;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// Strip the thinking suffix "model(level)" so registry lookups hit the base id.
|
||||
@@ -36,15 +117,27 @@ function isMessagesModel(model) {
|
||||
return MESSAGES_MODELS.has(baseModelId(model));
|
||||
}
|
||||
|
||||
function resolveOpencodeSession(body, credentials) {
|
||||
function resolveOpencodeSession(body, credentials, providerSessionId, clientTool) {
|
||||
const headers = credentials?.rawHeaders || {};
|
||||
return resolveSessionId({
|
||||
const native = nativeSession(headers);
|
||||
if (native) return native;
|
||||
|
||||
let incoming = null;
|
||||
for (const [key, value] of Object.entries(headers)) {
|
||||
if (key.toLowerCase() === SESSION_HEADER) {
|
||||
incoming = normalizeSession(value);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
const resolved = incoming || normalizeSession(providerSessionId) || resolveSessionId({
|
||||
headers,
|
||||
body,
|
||||
connectionId: credentials?.connectionId,
|
||||
scope: "opencode",
|
||||
generate: generateSessionId,
|
||||
});
|
||||
|
||||
return resolved ? translateSessionId(resolved, clientTool) : generateSessionId();
|
||||
}
|
||||
|
||||
function normalizeOpencodeReasoning(model, body) {
|
||||
@@ -73,12 +166,21 @@ function normalizeOpencodeReasoning(model, body) {
|
||||
export class OpenCodeExecutor extends BaseExecutor {
|
||||
constructor() {
|
||||
super("opencode", PROVIDERS.opencode);
|
||||
this._currentSessionId = null;
|
||||
}
|
||||
|
||||
prepareRequestCredentials({ body, credentials, providerSessionId, clientTool } = {}) {
|
||||
const sourceCredentials = credentials || {};
|
||||
const resolved = resolveOpencodeSession(body, sourceCredentials, providerSessionId, clientTool);
|
||||
|
||||
return {
|
||||
...sourceCredentials,
|
||||
[SESSION_FIELD]: resolved,
|
||||
};
|
||||
}
|
||||
|
||||
transformRequest(model, body, stream, credentials) {
|
||||
this._currentSessionId = resolveOpencodeSession(body, credentials);
|
||||
if (isResponsesModel(model)) {
|
||||
if (body && typeof body === "object" && model && !body.model) body.model = model;
|
||||
if (isResponsesModel(model) && body && typeof body === "object") {
|
||||
// Responses API names the output cap max_output_tokens and takes thinking
|
||||
// as reasoning:{effort,summary} — normalize the Chat fields at this boundary.
|
||||
if (body.max_output_tokens === undefined) {
|
||||
@@ -92,6 +194,10 @@ export class OpenCodeExecutor extends BaseExecutor {
|
||||
return injectReasoningContent({ provider: this.provider, model, body });
|
||||
}
|
||||
|
||||
async execute(args) {
|
||||
return super.execute({ ...args, credentials: this.prepareRequestCredentials(args) });
|
||||
}
|
||||
|
||||
buildUrl(model) {
|
||||
const base = this.config.baseUrl;
|
||||
if (isResponsesModel(model)) return `${base}/zen/v1/responses`;
|
||||
@@ -105,14 +211,16 @@ export class OpenCodeExecutor extends BaseExecutor {
|
||||
for (const [k, v] of Object.entries(raw)) lower[k.toLowerCase()] = v;
|
||||
|
||||
const downstreamUa = lower["user-agent"] || "";
|
||||
const isOpencodeDownstream = downstreamUa.toLowerCase().includes("opencode");
|
||||
const isOpencodeDownstream = hasValidOpencodeVersion(downstreamUa);
|
||||
|
||||
const session = credentials?.[SESSION_FIELD] || this.prepareRequestCredentials({ credentials })[SESSION_FIELD];
|
||||
|
||||
const headers = {
|
||||
"Content-Type": "application/json",
|
||||
"Authorization": "Bearer public",
|
||||
"User-Agent": isOpencodeDownstream ? downstreamUa : OPENCODE_UA,
|
||||
"x-opencode-client": lower["x-opencode-client"] || "desktop",
|
||||
"x-opencode-session": lower["x-opencode-session"] || this._currentSessionId || generateSessionId(),
|
||||
"x-opencode-session": session,
|
||||
"x-opencode-request": lower["x-opencode-request"] || generateRequestId(),
|
||||
"x-opencode-project": lower["x-opencode-project"] || "global",
|
||||
"Accept": stream ? "text/event-stream" : "*/*",
|
||||
|
||||
202
tests/unit/opencode-session.test.js
Normal file
202
tests/unit/opencode-session.test.js
Normal file
@@ -0,0 +1,202 @@
|
||||
import { beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
const { fetchMock } = vi.hoisted(() => ({
|
||||
fetchMock: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("../../open-sse/utils/proxyFetch.js", () => ({
|
||||
proxyAwareFetch: fetchMock,
|
||||
}));
|
||||
|
||||
import { getExecutor } from "../../open-sse/executors/index.js";
|
||||
import {
|
||||
OPENCODE_SESSION_RE,
|
||||
generateSessionId,
|
||||
generateRequestId,
|
||||
translateSessionId,
|
||||
} from "../../open-sse/executors/opencode.js";
|
||||
|
||||
function makeCredentials(overrides = {}) {
|
||||
return {
|
||||
connectionId: "conn_test",
|
||||
rawHeaders: {},
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function prepare(executor, overrides = {}) {
|
||||
const credentials = overrides.credentials || makeCredentials();
|
||||
const prepared = executor.prepareRequestCredentials({
|
||||
body: overrides.body || { input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] }] },
|
||||
credentials,
|
||||
providerSessionId: overrides.providerSessionId ?? "conversation-a",
|
||||
clientTool: overrides.clientTool ?? "claude",
|
||||
});
|
||||
return { credentials, prepared };
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
fetchMock.mockReset();
|
||||
fetchMock.mockResolvedValue(new Response("{}", {
|
||||
status: 200,
|
||||
headers: { "content-type": "application/json" },
|
||||
}));
|
||||
});
|
||||
|
||||
describe("OpenCode Free Session ID Format", () => {
|
||||
it("generates session IDs matching OpenCode canonical format (ses_ + 12 hex + 14 base62)", () => {
|
||||
for (let i = 0; i < 20; i++) {
|
||||
const id = generateSessionId();
|
||||
expect(id).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(id).toHaveLength(30);
|
||||
}
|
||||
});
|
||||
|
||||
it("generates request IDs matching OpenCode canonical format (msg_ + 12 hex + 14 base62)", () => {
|
||||
for (let i = 0; i < 20; i++) {
|
||||
const id = generateRequestId();
|
||||
expect(id).toMatch(/^msg_[0-9a-f]{12}[0-9A-Za-z]{14}$/);
|
||||
expect(id).toHaveLength(30);
|
||||
}
|
||||
});
|
||||
|
||||
it("translates arbitrary sessions into valid OpenCode session format", () => {
|
||||
const inputs = [
|
||||
"claude:550e8400-e29b-41d4-a716-446655440000",
|
||||
"antigravity:conv-abc-123",
|
||||
"session-from-codex",
|
||||
"12345",
|
||||
"",
|
||||
];
|
||||
for (const raw of inputs) {
|
||||
const translated = translateSessionId(raw, "claude");
|
||||
expect(translated).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(translated).toHaveLength(30);
|
||||
}
|
||||
});
|
||||
|
||||
it("preserves already-valid OpenCode sessions without re-hashing", () => {
|
||||
const valid = "ses_f534dfae8ffeCy4Ee4tLWNygDc";
|
||||
expect(translateSessionId(valid)).toBe(valid);
|
||||
expect(translateSessionId(` ${valid} `)).toBe(valid);
|
||||
});
|
||||
});
|
||||
|
||||
describe("OpenCode Free Executor Session Resolution", () => {
|
||||
it("uses request-local session credentials without mutating source credentials", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const { credentials, prepared } = prepare(executor);
|
||||
|
||||
expect(executor.constructor.name).toBe("OpenCodeExecutor");
|
||||
expect(prepared).not.toBe(credentials);
|
||||
expect(prepared._opencodeSession).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(credentials).not.toHaveProperty("_opencodeSession");
|
||||
expect(executor).not.toHaveProperty("_currentSessionId");
|
||||
});
|
||||
|
||||
it("preserves valid native x-opencode-session header case-insensitively", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const valid = "ses_f534dfae8ffeCy4Ee4tLWNygDc";
|
||||
const { prepared } = prepare(executor, {
|
||||
credentials: makeCredentials({ rawHeaders: { "X-OpenCode-Session": ` ${valid} ` } }),
|
||||
});
|
||||
|
||||
expect(prepared._opencodeSession).toBe(valid);
|
||||
});
|
||||
|
||||
it("translates invalid native x-opencode-session header into a valid session", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const { prepared } = prepare(executor, {
|
||||
credentials: makeCredentials({ rawHeaders: { "x-opencode-session": "invalid-session-uuid" } }),
|
||||
});
|
||||
|
||||
expect(prepared._opencodeSession).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(prepared._opencodeSession).not.toBe("invalid-session-uuid");
|
||||
});
|
||||
|
||||
it("translates conversation session deterministically", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const first = prepare(executor, { providerSessionId: "conversation-a", clientTool: "claude" }).prepared._opencodeSession;
|
||||
const second = prepare(executor, { providerSessionId: "conversation-a", clientTool: "claude" }).prepared._opencodeSession;
|
||||
|
||||
expect(first).toBe(second);
|
||||
expect(first).toMatch(OPENCODE_SESSION_RE);
|
||||
});
|
||||
|
||||
it("isolates different conversations and tools", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const convA = prepare(executor, { providerSessionId: "conversation-a" }).prepared._opencodeSession;
|
||||
const convB = prepare(executor, { providerSessionId: "conversation-b" }).prepared._opencodeSession;
|
||||
const toolClaude = prepare(executor, { providerSessionId: "same", clientTool: "claude" }).prepared._opencodeSession;
|
||||
const toolCodex = prepare(executor, { providerSessionId: "same", clientTool: "codex" }).prepared._opencodeSession;
|
||||
|
||||
expect(convA).not.toBe(convB);
|
||||
expect(toolClaude).not.toBe(toolCodex);
|
||||
});
|
||||
|
||||
it("adds the valid session header to fetch requests", async () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const credentials = makeCredentials();
|
||||
const result = await executor.execute({
|
||||
model: "muse-spark-1.3-contributor-free",
|
||||
body: { input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hello" }] }] },
|
||||
stream: false,
|
||||
credentials,
|
||||
providerSessionId: "conversation-fetch-test",
|
||||
clientTool: "claude",
|
||||
});
|
||||
|
||||
expect(result.headers["x-opencode-session"]).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(fetchMock).toHaveBeenCalledOnce();
|
||||
expect(fetchMock.mock.calls[0][1].headers["x-opencode-session"]).toBe(result.headers["x-opencode-session"]);
|
||||
expect(fetchMock.mock.calls[0][1].headers["Authorization"]).toBe("Bearer public");
|
||||
expect(credentials).not.toHaveProperty("_opencodeSession");
|
||||
});
|
||||
|
||||
it("falls back to a valid generated session in buildHeaders when called standalone", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const headers = executor.buildHeaders({});
|
||||
|
||||
expect(headers["x-opencode-session"]).toMatch(OPENCODE_SESSION_RE);
|
||||
expect(headers["Authorization"]).toBe("Bearer public");
|
||||
});
|
||||
it("handles null or undefined body gracefully in transformRequest", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
expect(() => executor.transformRequest("muse-spark-1.3-contributor-free", null, false, {})).not.toThrow();
|
||||
expect(() => executor.transformRequest("big-pickle", undefined, false, {})).not.toThrow();
|
||||
});
|
||||
});
|
||||
|
||||
describe("OpenCode Free User-Agent Validation", () => {
|
||||
it("defaults User-Agent to opencode/1.18.31 for non-opencode downstream clients", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const headersNoUa = executor.buildHeaders({});
|
||||
expect(headersNoUa["User-Agent"]).toBe("opencode/1.18.31");
|
||||
|
||||
const headersClaude = executor.buildHeaders({ rawHeaders: { "user-agent": "Claude-Code/1.0" } });
|
||||
expect(headersClaude["User-Agent"]).toBe("opencode/1.18.31");
|
||||
});
|
||||
|
||||
it("replaces bare opencode with versioned opencode/1.18.31 to prevent 403 FreeTierError", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const headers = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode" } });
|
||||
expect(headers["User-Agent"]).toBe("opencode/1.18.31");
|
||||
});
|
||||
|
||||
it("upgrades outdated opencode versions (< 1.17) to prevent 426 Upgrade Required", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const headers = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode/1.15.0" } });
|
||||
expect(headers["User-Agent"]).toBe("opencode/1.18.31");
|
||||
});
|
||||
|
||||
it("preserves valid opencode versions (>= 1.17)", () => {
|
||||
const executor = getExecutor("opencode");
|
||||
const headers118 = executor.buildHeaders({
|
||||
rawHeaders: { "user-agent": "opencode/1.18.31 ai-sdk/provider-utils/4.0.40 runtime/bun/1.3.14" },
|
||||
});
|
||||
expect(headers118["User-Agent"]).toBe("opencode/1.18.31 ai-sdk/provider-utils/4.0.40 runtime/bun/1.3.14");
|
||||
|
||||
const headersFuture = executor.buildHeaders({ rawHeaders: { "user-agent": "opencode/1.19.0" } });
|
||||
expect(headersFuture["User-Agent"]).toBe("opencode/1.19.0");
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user